API

claude mcp add --transport http daybag https://daybag.io/api/mcp --header "Authorization: Bearer daybag_live_…"

{
  "mcpServers": {
    "daybag": {
      "type": "http",
      "url": "https://daybag.io/api/mcp",
      "headers": {
        "Authorization": "Bearer daybag_live_…"
      }
    }
  }
}

claude.ai and ChatGPT connect once OAuth sign-in lands.

1. 1Find an offeringofferings_list
   curlCopy

   curl "https://daybag.io/api/v1/offerings" \
     -H "Authorization: Bearer daybag_live_…"

   200response

   {
     "data": [
       {
         "id": "8f1c2e4a-0b7d-4c55-9a7e-3f2d1c0b9a88",
         "kind": "rental",
         "name": "Touring kayak",
         "duration_minutes": 1440,
         "capacity": 10,
         "max_per_booking": 4,
         "price_cents": 3500,
         "active": true
       }
     ]
   }

2. 2Pick a slotavailability_get
   curlCopy

   curl "https://daybag.io/api/v1/offerings/8f1c2e4a-0b7d-4c55-9a7e-3f2d1c0b9a88/availability?from=2026-12-05&to=2026-12-05" \
     -H "Authorization: Bearer daybag_live_…"

   200response

   {
     "timezone": "America/Denver",
     "data": [
       {
         "starts_at": "2026-12-05T15:00:00.000Z",
         "ends_at": "2026-12-06T15:00:00.000Z",
         "capacity": 10,
         "remaining": 8
       }
     ]
   }

3. 3Book itbookings_create
   curlCopy

   curl -X POST https://daybag.io/api/v1/bookings \
     -H "Authorization: Bearer daybag_live_…" \
     -H "Content-Type: application/json" \
     -d '{
       "offering_id": "8f1c2e4a-0b7d-4c55-9a7e-3f2d1c0b9a88",
       "starts_at": "2026-12-05T15:00:00Z",
       "quantity": 2,
       "customer": { "email": "pat@example.com", "name": "Pat" }
     }'

   201response

   {
     "id": "1e2d3c4b-5a69-4788-9a6b-5c4d3e2f1a0b",
     "reference": "0GWYRZ2V",
     "status": "confirmed",
     "starts_at": "2026-12-05T15:00:00+00:00",
     "ends_at": "2026-12-06T15:00:00+00:00",
     "quantity": 2,
     "total_cents": 7000,
     "offering": {
       "id": "8f1c2e4a-0b7d-4c55-9a7e-3f2d1c0b9a88",
       "name": "Touring kayak",
       "kind": "rental",
       "location": "North dock",
       "duration_minutes": 1440
     },
     "customer": {
       "id": "5d4c3b2a-1f0e-4d9c-8b7a-6f5e4d3c2b1a",
       "name": "Pat",
       "email": "pat@example.com",
       "phone": ""
     }
   }

<script src="https://daybag.io/widget.js" data-org="your-slug" async></script>

Options

After a booking

window.addEventListener("daybag:booked", (event) => {
  const { org, reference } = event.detail; // e.g. "big-sky", "0GWYRZ2V"
});

A paid booking is held first (booking.held) and confirmed when the payment lands; a free one confirms at once. Every event carries a source: dashboard, api, mcp, widget or stripe.

Poll

curl "https://daybag.io/api/v1/events?after=0" \
  -H "Authorization: Bearer daybag_live_…"

{
  "data": [
    {
      "id": 42,
      "type": "booking.confirmed",
      "data": {
        "id": "1e2d3c4b-5a69-4788-9a6b-5c4d3e2f1a0b",
        "reference": "0GWYRZ2V",
        "status": "confirmed"
      },
      "created_at": "2026-12-01T17:04:11+00:00"
    }
  ],
  "next_after": 42
}

Webhooks

Add an HTTPS endpoint with webhooks_create. Each event arrives as a JSON POST signed with the secret it returns once:

1. Keep the raw request body; verify before you parse it.
2. Split the header at the commas: t is a unix time, v1 the signature.
3. HMAC-SHA256 the string "<t>.<raw body>" with your webhook secret, hex encoded, and compare it to v1 in constant time.
4. Reject a t more than five minutes away, so a captured request can't be replayed.

import { createHmac, timingSafeEqual } from "node:crypto";

// body: the raw request body · header: the Daybag-Signature header
function verify(secret, body, header) {
  const { t, v1 = "" } = Object.fromEntries(header.split(",").map((part) => part.split("=")));
  if (!t || Math.abs(Date.now() / 1000 - Number(t)) > 300) return false; // missing, stale or replayed
  const expected = createHmac("sha256", secret).update(`${t}.${body}`).digest("hex");
  return v1.length === expected.length && timingSafeEqual(Buffer.from(v1), Buffer.from(expected));
}